CVE-2026-79654: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Satellite 6.16 for RHEL 8

The vulnerability CVE-2026-79654 in Red Hat Satellite 6.16 for RHEL 8 arises from improper authorization enforcement in the Katello Content View History API. An authenticated user authorized to view Content Views within one organization can bypass authorization controls to access lifecycle history data of Content Views from other organizations by manipulating the API request with a user-controlled Content View identifier. This results in unauthorized disclosure of sensitive lifecycle information such as publication and promotion events, user associations, and timestamps. The CVSS v3.1 base score is 4.3 (medium severity), reflecting a network attack vector with low complexity and limited confidentiality impact. The vendor advisory references updates in Satellite 6.19 but does not explicitly confirm a patch for 6.16 in the provided data.

The impact of this vulnerability is unauthorized disclosure of Content View lifecycle information across organizational boundaries within Red Hat Satellite. This includes sensitive metadata such as publication and promotion events, associated users, and timestamps. There is no indication of integrity or availability impact. The vulnerability requires authenticated access with permission to view Content Views in at least one organization, and the attack complexity is low.

Red Hat has published a security advisory (RHSA-2026:74503) addressing this and other vulnerabilities in Red Hat Satellite 6.19. Users should consult the vendor advisory for detailed remediation instructions. The advisory indicates that updates are available for Satellite 6.19; however, the patch status for version 6.16 is not explicitly stated in the provided data. Administrators should verify if updates or backported fixes are available for their specific version and apply them accordingly. Patch status is not yet confirmed for 6.16—check the vendor advisory for current remediation guidance.